Keep HTTP admin and cabinet sessions by not requiring Secure cookies or Origin CSRF.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/cms/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moniki/cms",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "private": true,
   "type": "module",
   "scripts": {

apps/cms/src/collections/Users.ts

@@ -8,8 +8,7 @@ export const Users: CollectionConfig = {
     tokenExpiration: 60 * 60 * 24 * 7,
     cookies: {
       sameSite: 'Lax',
-      // HTTP admin (IP:3001) cannot store Secure cookies; enable only on HTTPS.
-      secure: (process.env.NEXT_PUBLIC_SERVER_URL || '').startsWith('https://'),
+      secure: false,
     },
   },
   admin: {

apps/cms/src/payload.config.ts

@@ -114,7 +114,8 @@ export default buildConfig({
   }),
   sharp,
   cors: allowedOrigins,
-  csrf: allowedOrigins,
+  // Empty list: do not drop the session cookie when Origin is missing or atypical (HTTP IP:port admin).
+  csrf: [],
   localization: {
     locales: [
       { code: 'ru', label: 'Русский' },